1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.exe
Size 9.0MB
Sample260812-2f772sfb73
SHA256 9592a3c354a88902c80235dab679b514a4780123512fb7a8d14440089a575dfa
MD5 5933c823edb2b15676e74ea15f688d2b
SHA1 52d8c01dd4bd74756de09b745c615376c80d7980
SHA512 010c2e0d34e166321251693908ed5869018c284595840c527bb9a6a5093af12d13e306c0c91243fb3a58a28f3df9873ebbeabe9eb5babcd47fb946aeffdc4a1f
SSDEEP 98304:COpYfjDCSeQFZX8+Io4pi+UnVorWbU5kAECgHmyCvlD6b:obuSXSG6kAVgHHU
TLSH
T176969E03F353D2ECC52AC4308355A333FB72BC89463676AB6B945B306E92B605A1DF59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1.exe

File Explorer

1.exe

.exe 9.0MB

1.exe

IMPHASH ca70c48af7ea79b441d9c61ac899d834
SHA256 9592a3c354a88902c80235dab679b514a4780123512fb7a8d14440089a575dfa
MD5 5933c823edb2b15676e74ea15f688d2b
SHA1 52d8c01dd4bd74756de09b745c615376c80d7980
SHA512 010c2e0d34e166321251693908ed5869018c284595840c527bb9a6a5093af12d13e306c0c91243fb3a58a28f3df9873ebbeabe9eb5babcd47fb946aeffdc4a1f
SSDEEP 98304:COpYfjDCSeQFZX8+Io4pi+UnVorWbU5kAECgHmyCvlD6b:obuSXSG6kAVgHHU
TLSH
T176969E03F353D2ECC52AC4308355A333FB72BC89463676AB6B945B306E92B605A1DF59
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4119

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036 ImpersonateAnonymousToken RevertToSelf

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CompareStringOrdinal DeleteCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte __C_specific_handler AttachConsole CloseHandle CreateFileMappingA CreateFileW CreatePipe CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FormatMessageW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemFirmwareTable GetSystemTimeAsFileTime GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete K32GetProcessMemoryInfo LoadLibraryA LoadLibraryExA LoadLibraryExW MapViewOfFile Module32FirstW Module32NextW OpenProcess PeekNamedPipe Process32FirstW Process32NextW QueryFullProcessImageNameW ReadFile ReadFileEx RtlLookupFunctionEntry SetFileInformationByHandle SetHandleInformation SetLastError SetThreadErrorMode SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtectEx WaitForSingleObject WriteConsoleW WriteFileEx WriteProcessMemory

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _hypot _initterm abort acos asin atan atexit calloc cosh exit fprintf free ldexp malloc memcmp memcpy memmove memset signal sinh strerror strlen strncmp tan tanh vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError RtlGetVersion

user32

CloseClipboard CloseTouchInputHandle EmptyClipboard GetClipboardData GetTouchInputInfo IsClipboardFormatAvailable OpenClipboard RegisterClipboardFormatW RegisterTouchWindow SetClipboardData AdjustWindowRectEx AppendMenuW ChangeDisplaySettingsExW ClientToScreen ClipCursor CreateIcon CreateIconFromResourceEx CreateIconIndirect CreatePopupMenu CreateWindowExW DefWindowProcW DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageW EnableMenuItem EnumDisplayMonitors EnumWindows FlashWindowEx GetClassLongPtrW GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetIconInfo GetMenu GetMessageW GetMonitorInfoW GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InvalidateRgn IsIconic IsProcessDPIAware IsWindowVisible LoadCursorW LoadIconW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RedrawWindow RegisterClassExW RegisterClassW RegisterWindowMessageA RegisterWindowMessageW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetCursor SetCursorPos SetForegroundWindow SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA TrackPopupMenu TranslateMessage ValidateRect GetActiveWindow GetAsyncKeyState GetKeyState GetKeyboardLayout GetKeyboardState GetRawInputData MapVirtualKeyExW MapVirtualKeyW RegisterRawInputDevices ReleaseCapture SendInput SetCapture ToUnicodeEx TrackMouseEvent

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

ole32

OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize

uxtheme

SetWindowTheme

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getsockopt ioctlsocket recv recvfrom select send sendto setsockopt shutdown

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

gdi32

CreateBitmap CreateRectRgn DeleteObject GetDIBits GetDeviceCaps GetObjectW

oleaut32

SysFreeString SysStringLen GetErrorInfo

shell32

DragFinish DragQueryFileW ExtractIconExW Shell_NotifyIconW

shlwapi

AssocQueryStringW

combase

CoIncrementMTAUsage

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1.exe

advapi32

bcrypt

kernel32

msvcrt

ntdll

user32

imm32

ole32

uxtheme

ws2_32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

d3d11

dwmapi

gdi32

oleaut32

shell32

shlwapi

combase

generic